ZeuS Trojan Gang Faces Justice

Authorities in the United Kingdom have convicted the 13th and final defendant from a group arrested last year and accused of running an international cybercrime syndicate that laundered millions of dollars stolen from consumers and businesses with the help of the help of the ZeuS banking Trojan. The news comes days after U.S. authorities announced the guilty plea of the 27th and final individual arrested last year in New York in a related international money-laundering scheme.

Yevhen Kulibaba

According to the Metropolitan Police, the U.K. courts have convicted 13 members of the gang, including four who were profiled last year by KrebsOnSecurity shortly after their initial arrest and charging. The gang is thought to have used the ZeuS Trojan to steal nearly £3 million (USD $4.6M) from banks in the U.K.. They are believed to be responsible for aiding in the theft of at least USD $3 million from U.S. banks and businesses in the past two years.

Karina Kostromina

Among those convicted were the husband-and-wife ringleaders of the gang, 33-year-old Ukrainian property developer Yevhen Kulibaba, and his wife, Karina Kostromina, 34. According to British prosecutors, the two lived a “jet set” lifestyle and spent money on holidays, cars and property. Kostromina was cleared of conspiracy charges but convicted of money laundering, and sentenced this week to two years in prison. Kulibaba is awaiting sentencing on charges of conspiracy to defraud.

Yuriy Konovalenko

An individual described as Kulibaba’s right-hand man — 29-year-old Yuriy Konovalenko, aka “Pavel Klikov” — is due to be sentenced, also for conspiracy. Valerij Milka, a 30-year-old Ukrainian whom U.K. police say was a building laborer and fourth member of the conspiracy, was jailed for three years after admitting his role.

Milka "Valera" Valerij

News of the convictions in the United Kingdom comes days after authorities in the United States announced the guilty plea of the 27th and final individual arrested last year in New York as part of a major law enforcement sweep against Russian and Eastern European exchange students-turned-money mules. U.S. prosecutors have charged a total of 37 Russian and Eastern European students in connection with last year’s law enforcement sweep; According to the FBI, two defendants have entered into deferred prosecution agreements, and eight defendants are fugitives and are being sought in the United States and abroad.

It should be noted that these individuals were only a small part of a much larger fraud ring. According to sources close to the investigation, the true masterminds of these ZeuS-powered bank heists reside in Donetsk, Ukraine, and have yet to be charged with any crime. Authorities in Ukraine this time last year detained five individuals identified by the FBI and other national law enforcement authorities as the “coders and exploiters” in the fraud operation, but the men were released and have not been charged with a crime.